[Bro] A question about loading signature files
robin at icir.org
Wed Oct 19 18:56:33 PDT 2011
On Thu, Oct 20, 2011 at 00:02 +0800, you wrote:
> However, when Bro loaded test.bro, many errors like
> "smtp_servers(http_servers ...) didn't defined".
These are defined in snort.bro, you can just load that.
However, frankly, I don't recommend using the Snort signature at all
anymore. They are not only very old, but also generally not really
useful with Bro.
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org
More information about the Bro